Make sure the add-on is not visible. If the Visible column for the add-on is set to Yes, click Edit properties and change Visible to No. Disabling visibility of add-ons on search heads is recommended to avoid inputs from being created on search heads. Data collection components are not recommended for search heads because of the potential to conflict with users' search activity.

You can also find it on the server at $SPLUNK_HOME/etc/apps/<Name_of_add-on>.

Search head clusters

Before deploying an add-on to a search head cluster, check the documentation of the add-on to ensure it is supported on search head clusters. The add-on documentation might also include pre-deployment steps that you must perform in order to avoid validation errors. The files that cause the validation errors are all irrelevant to search head functionality, but the validation errors prevent deployment.

Unless otherwise instructed in the documentation for the specific add-on, before deploying an add-on to a search head cluster, make the following changes to the add-on package:

Remove the eventgen.conf files and all files in the samples folder.

Remove the inputs.conf and inputs.conf.spec files, if the add-on contains them. Exception: If you are collecting data locally from the machines running your search head nodes, keep these files.

Indexer clusters

If the add-on defines configurations for modular inputs that are located in apps or add-ons that are not included in the configuration bundle, your deployment of the configuration bundle fails due to validation errors. The affected files are all irrelevant to indexer functionality, provided that you configure your inputs on forwarders, but the validation errors prevent deployment.

To work around this issue, before deploying add-ons to indexer clusters, make the following changes to the add-on package unless the documentation for the add-on overrides these instructions:

Remove the eventgen.conf files and all files in the samples folder.

Remove the inputs.conf and inputs.conf.spec files, if the add-on contains them. Exception: If you are collecting data locally from the machines running your indexers, keep these files.

Remove the database.conf file, if it contains one.

Deploy add-ons to peer nodes on indexer clusters using a master node. For more information about using a master node to deploy to peer nodes of an indexer cluster, see Manage app deployment across all peers in Managing Indexers and Clusters of Indexers.

Universal or light forwarders

Check the installation instructions for each individual add-on to determine which forwarder types are supported.

Install an add-on in a distributed Splunk Enterprise deployment

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »